The leading social network had originally said up to 50 million accounts were affected in a cyberattack that exploited a trio of software flaws to steal "access tokens" that enable people to automatically log back into the social network.
"We now know that fewer people were impacted than we originally thought," Facebook vice president of product management Guy Rosen said in an online post.
"We're cooperating with the FBI, which is actively investigating and asked us not to discuss who may be behind this attack," he added.
Cyberattackers accessed that data plus additional information including gender, religion, hometown, birth date, and places they had recently "checked in" to as visiting, according to Facebook.
No data was accessed in the accounts of the remaining one million people whose "access tokens" were stolen, according to Rosen.
The attack did not affect Facebook-owned Messenger, Messenger Kids, Instagram, WhatsApp, Oculus, Workplace, Pages, payments, third-party apps, or advertising or developer accounts, the company says.
Facebook said engineers discovered a breach on Sept. 25 and had it patched two days later.
That breach allegedly related to a "view as" feature -- described as a privacy tool to let users see how their profiles look to other people. That function has been disabled for the time being as a precaution.
"It's clear that attackers exploited a vulnerability in Facebook's code," said Rosen.
"We've fixed the vulnerability and informed law enforcement."
Facebook reset the 50 million accounts it thought could have been affected, meaning users will need to sign back in using passwords.
The breach was the latest privacy embarrassment for Facebook, which earlier this year acknowledged that tens of millions of users had their personal data hijacked by Cambridge Analytica, a political firm working for Donald Trump in 2016.
"We face constant attacks from people who want to take over accounts or steal information around the world," chief executive Mark Zuckerberg said on his own Facebook page when the breach was disclosed.
"While I'm glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place."
Facebook said it took a precautionary step of resetting "access tokens" for another 40 million accounts which had accessed the "view as" function. Those users will need to log back in to Facebook.
More about: Facebook
